Rusoto: Getting started with assume role

[kpcyrd]

hey,

I'm trying to use this for a slightly complicated setup. On the aws-cli, I'm using aws --profile=Foo --region=eu-west-1 ec2 ... to use sts:assume-role to "assume" into a different aws account. The profiles are configured in ~/.aws/config, the credentials are configured in ~/.aws/credentials.

I'm having trouble getting started with this, are there any pointers on how I would get a working provider?

I found this: https://github.com/rusoto/rusoto/blob/master/AWS-CREDENTIALS.md that doesn't mention my specific usecase.

There's a ticket that looks very similar to my usecase (https://github.com/rusoto/rusoto/issues/429) but using the code mentioned there my program is stuck connecting to 169.254.169.254:80 instead of using my local config.

[kpcyrd]

For everybody else being lost on this, I managed to get it to work using this code:

extern crate env_logger;
extern crate rusoto_core;
extern crate rusoto_ec2;
extern crate rusoto_sts;

use std::default::Default;

use rusoto_core::{DefaultCredentialsProvider, Region};
use rusoto_core::default_tls_client;

use rusoto_ec2::{Ec2Client, Ec2};
use rusoto_sts::StsClient;
use rusoto_sts::StsAssumeRoleSessionCredentialsProvider;

fn main() {
    env_logger::init().unwrap();

    let credentials = DefaultCredentialsProvider::new().unwrap();
    let sts = StsClient::new(default_tls_client().unwrap(), credentials, Region::EuWest1);

    let provider = StsAssumeRoleSessionCredentialsProvider::new(
        sts,
        "arn:aws:iam::something:role/something".to_owned(),
        "default".to_owned(),
        None, None, None, None
    );

    let client = Ec2Client::new(default_tls_client().unwrap(), provider, Region::UsEast1);

    let sir_input = Default::default();
    println!("[*] requesting...");
    let x = client.describe_spot_instance_requests(&sir_input);

    println!("{:?}", x);
}

It might not be the best solution, I'd love if somebody could point me to the correct resource for this :)

[matthewkmayer]

Thanks for reporting back how you got it working! I haven't used STS much, but @cmsd2 has a project that uses Rusoto for STS assume role. Perhaps that code can help or he can chime in with some hints. 😄

[cmsd2]

Looks about right.

[matthewkmayer]

Thanks!

@kpcyrd anything else you need addressed in this issue? Maybe we can get this use case documented somewhere for the next person needing this behavior.

[kpcyrd]

@matthewkmayer If this is indeed the correct way to do it, I'd like to PR it into the docs somewhere so the next person trying to do the same thing can find it more easily. :)

I'm not sure what's the best place to put it. Are you ok with a PR that extends AWS-CREDENTIALS.md and adds the example to StsAssumeRoleSessionCredentialsProvider?

[matthewkmayer]

Sounds like a great place to put it! Let me know if I can help with the PR.